[MagicAndre1981]

How to get the cause of high CPU usage caused by applications

Ok, you found this guide because you see a high CPU usage in ProcessExplorer/Task manager.


If you see this:

 ProcessExplorer_DPC_1.png (37.7K)
Number of downloads: 873

you have an issue with a driver. To trace this, follow this guide:

http://www.msfn.org/...howtopic=140263



Here you'll lean to see the cause of a Windows Exe/Service which causes a high CPU usage.

To get started you need the Windows Performance Tools Kit. Read here how to install it:

http://www.msfn.org/...howtopic=146919

Now open a command prompt (cmd.exe) with admin rights, go to a directory like C:\temp and run the following commands:

xperf -on latency -stackwalk profile

now wait a time while the high CPU usage from an application occurs and wait a few seconds until enough data are traced.

To stop the trace run the following command:

xperf -d latency.etl

This closes the trace and writes the result to the file latency.etl.

In the next step, make a double click on the etl file to run the Viewer.

Now wait until the 2 passes are over.

Go to "Trace"->"Configure Symbol Paths" and type in the following:

srv*C:\symbols*http://msdl.microsoft.com/download/symbols

Click ok, to close the dialog.

Now go to the graph "CPU sampling per CPU" and select the interval where you have the high CPU usage, make a right click and select "Load Symbols" and next click "clone selection". Make a rightclick again and select "summary tabke" and you see this:

 CPUusage_xperfview_CPUSampling_per_Process.png (15.13K)
Number of downloads: 391

and look which process causes the CPU usage (Here it is the TrustedInstaller.exe)

Now, go to the first graph "Stack Counts by Type", make a right click and select Summary Table.

 CPUusage_xperfview.png (10.69K)
Number of downloads: 379

Now, you have to accept the license agreement to download the public debugging symbols.

(NOTE, THE PDBs ARE SOMETIME VERY HUGE. BE AWARE THAT IT MAY TAKE SOME TIME IF YOU HAVE A SLOW INTERNET CONNECTION.

Here you'll see summary of the calls (make sure you sort the data per Count: Sampled Profile) and locate the Process from the former summary table which causes the high CPU usage. The important thing is the "Stack". Expand the view until the count number reduces much and you see this:

 xperfview_cpuusage_stack.png (61.81K)
Number of downloads: 710

For me, the high CPU usage from explorer is caused while searching for installed apps to show them inside the Software- Add/remove Dialog (CreateItemIDFromInstalledApps).

If you can't see Thread names in the stack, the PDBs are missing. So if the issue occurs in a Microsoft application like Office or MSE, the required symbols are not available on the symbol server so you can't find the cause.

If you have high CPU usage in Firefox add the this:

;SRV*c:\symbols\*http://symbols.mozilla.org/firefox

to the symbol path in xperfview and load the symbols again to see more.

If you develop your own tool, add the path to your PDB files which generated the VC++ compiler for you.

If no symbols are available, look at the filename to see which program it is and run this command:

xperf -I latency.etl -a fileversion > fileversion.txt

Now open the fileversion.txt and search for the program. Now look at the fileversion, to a bing/google search to see if this is the latest version of the program. If not, update it and see if this update fixes it. If you use the latest version and the issue is not fixed contact the support and send the etl to them, so that they can see the cause of the high CPU usage in their applications.

// Edit 2010-03-22

To enable Stackwalk on a x64 Windows, you have to set a registry value. Start Regedit.exe and go to the following key:

HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management

and create a DWORD (if it not already exists) DisablePagingExecutive and set the value to 1 and reboot to enable the setting.

The Debugging Team made a Video about this too. Check it out:

http://blogs.msdn.co...onsumption.aspx

This post has been edited by MagicAndre1981: 30 July 2011 - 07:17 AM

[Strepnox]

MagicAndre:

Great instructions!! What happens if you end up with an "unknown" process?

[MagicAndre1981]

Hi,

have you selected Load Symbols?

André

[Strepnox]

Yes, Andre...took awhile. The first table I looked at (and graph) only listed the process as "unknown". Gave it a second try and it appears (while playing online game Everquest) I got a three minute lag/maxed CPU usage that I was lucky enough to capture. Half the count (659k+) is in the idle process, the other half the game. First process is -amdppm.sys!C1Halt followed buy hundreds of single count, un-named processes. I'd send you the stacks summary table if I knew how.

Strepnox

[MagicAndre1981]

C1 Halt ( http://www.hardwares...m/article/611/2 and http://en.wikipedia....Power_Interface ) is a power saving feature and doesn't slow down your PC.

Could you please zip the trace and upload it somewhere?

[Strepnox]

MagicAndre1981, on 17 February 2010 - 05:56 PM, said:

C1 Halt ( http://www.hardwares...m/article/611/2 and http://en.wikipedia....Power_Interface ) is a power saving feature and doesn't slow down your PC.

Could you please zip the trace and upload it somewhere?

Thx for the quick response...here's sys info: MW 7 Premium [6.1.7600 Build 7600] HP Pav Mod: NY545AA-ABA p6210y X64 AMD Ath II x 4 620 Proc, 6 GB RAM


This problem arose recently on a three month-old system. Manifested in severe random lag while playing Everquest. Episodes start within five minutes of playing and are independent of gameplay dynamics; even occurs when character select screen is up and game is not being used. The occurrences last from one to three minutes then stop. I imagine if I had less mem I would be cursed with BSOD.

Trace:[url="http://www.mediafire.com/?lgzzjtinkoo"] -- File name: Feb17trace.zip 27.9 MB zipped

[MagicAndre1981]

Hi,

I can see that you have spikes in your Audio Subsystem. Those spikes occur every 11 seconds and take 6.7 seconds. I can see that you have a RealTek HD Audio device. Do you use the latest drivers?

André

[Strepnox]

MagicAndre1981, on 18 February 2010 - 06:24 AM, said:

Hi,

I can see that you have spikes in your Audio Subsystem. Those spikes occur every 11 seconds and take 6.7 seconds. I can see that you have a RealTek HD Audio device. Do you use the latest drivers?

André

About a week ago (after perusing all these forums), I was careful to check all of the drivers (audio, Nvidia, etc.) and upgraded as necessary. I even disabled the HD audio, the Nvidia 3D (each individually), to try and isolate but nothing changed. The last Realtek Windows update was updated a few days ago. So, to the best of my knowledge, all drivers are up-to-date. I have even scoured Sony's EQ tech forums to see if it's an interface issue on EQ's end, and find nothing.

My symptoms are identical to all of the other high CPU usage problems cited in these forums, but fall short of the BSOD. Just can't seem to isolate the process that's causing it, and remain curious about the stack table as there is a process near the bottom (with a relatively low count) that comes up as "unknown" at the beginning of the CPU spike.

[Strepnox]

Okay...time to post the sad hard truth in hopes that someone else might benefit from my misery.

If you're getting maxed CPU usage and you are running INTEGRATED graphics (like Nvidia GeForce 9100), make sure you check CPU temps. Open the box, pull out the over-priced can of compressed air and blow out the heat exchanger and fan. This is as simple a fix as a car that won't start, but not checking to see if there is gas in the tank!

Never would have believed it, but after checking countless forums for a week, an Nvidia forum revealed the fix that integrated graphics, lame though they are, are especially susceptible to the slightest layer of dust which, of course, impacts temps and response. I have had deeper layers of dust on the toilet seat, so I never would have believed such a minute bit of matter could have made such a difference!

Embarrassing though it is, after countless diagnostics, driver reloads, clean boots and re-installs, keep the bugger clean!

Magic Andre...thanx for your help! Thank you for the education!!!

Good luck all!

[MagicAndre1981]

ok, great to hear, that you fixed it

[skaustin]

Thanks for your efforts.

This post has been edited by skaustin: 28 October 2010 - 03:43 PM

[jimward]

I intalled the Windows Performance Toolkit. However, when I enter the xperf command, I get an error stating that xperf is not a valid command. Should xperf have installed with the Windows Performance Toolkit? I reinstalled a couple times, but still have the problem.

[MagicAndre1981]

look at the PATH environment variable and check if the path to the WPT was added.

[Killgore]

Hi!

I have similar problem with svchost.exe eating up to 50 % of CPU cycles. Especially after waking up from hibernation.

I've attached three legs that unfold from svchost in "Summary Table" that have most counts. It appears that it has something to do with windows firewall, but I can't go further than that.

Maybe for someone these numbers will be clearer.

Regards,
Chris

Attached File(s)

•  cpu.txt (12.53K)
  Number of downloads: 41

[MagicAndre1981]

this looks like the Windows Firewall is the cause.

[Killgore]

Do you have any assumptions what could be the root cause? I'm working in domain network and nobody else seems to have similar problems. I mean those entries in Stack Counts look like firewall is constantly updating it's entries. What could be the reason? And I do not use any network heavy programs.

[MagicAndre1981]

run Process Monitor in background and look what the Firewall does all the time.

[skoob]

Hi,

I'm using Windows 7 64-bit on a laptop with a wireless internet connection. Im having similar 100% cpu usage problems because of svchosts. The cpu is constantly at 100% for atleast 20 mins after startup or rebooted network connection, if the computer is left alone to run the services. Once everything is running its fine and the cpu settles at 20-30%. According to the processmonitor the problem seem to have something to do with iphlpsvc, netman, lanman and possibly some other service, which are the services that run during the problems.

I've seen people with similar issues with for example Win 7 beta but havent found any fix. Any help would be VERY appreciated!

Thanks

[MagicAndre1981]

run the xperf trace and upload the zipped trace to mediafire.com

[skoob]

Thanks!

http://www.mediafire...bp37a9ryhnau10o

Hope it works